Blockchain Papers

P. K. Sinha, Nishant Kumar, Piyush Aggarwal

No abstract is available for this record.

Khoa Tan Vo, Minh Ngo, Thu Nguyen, Thu-Thuy Ta · 7 authors

Scalability remains a key challenge for layer 1 blockchains. ZK-Rollups, leveraging zero-knowledge proofs, offer a promising layer 2 solution by improving throughput and reducing costs while preserving security. However, the performance of ZK-Rollup still poses a major barrier to practical implementation. The proving circuits in popular applications like ERC-20 transactions are highly complex, often containing a large number of constraints, which directly impacts the computation time and resources required to generate zero-knowledge proofs. This study presents an empirical study on the impact of constraint optimization in Circom on the performance of ERC-20 ZK-Rollups using Groth16. Three optimization levels (–O0, –O1, –O2) are evaluated across transaction batches ranging from 4 to 128, with further exploration up to 512 for specific optimization levels to assess scalability. Results show a trade-off: –O2 reduces constraints by up to 73.2% but increases compilation time by 213.35% at batch size 128, while –O1 offers a more balanced approach suitable for development stages. Findings confirm that proof generation time is closely tied to constraint count and complexity. Based on these insights, this study introduces ZCLS (ZK-Circuit Lifecycle Strategy), a practical framework for selecting optimization flags aligned with development stages to enhance ZK-Rollup system efficiency.

Carmen Wabartha

The end-to-end verifiable e-voting system Ordinos [26] is primarily characterized by its tally-hiding property, which ensures that only the actual election result, e. g., the winner of the election, is revealed while the full tally consisting of the aggregated votes stays hidden. Ordinos is an abstract model that guarantees tally-hiding, verifiability and vote privacy if the underlying cryptographic primitives satisfy certain requirements. It uses a multi-party-computation protocol over an additively homomorphic encryption scheme and guarantees active security with zero-knowledge proofs. Ordinos has already been instantiated for several election systems using the Paillier [35] encryption scheme, which can be broken by Shor’s algorithm [41]. The aim of this thesis is to instantiate Ordinos post-quantum secure using a variant of Regev’s LWE-based cryptosystem [39], which is adapted to realize an actively secure threshold encryption scheme over an arbitrary plaintext space. Then a noise analysis of the arithmetic and logical components used in the MPC-protocol of the Paillier instantiation is conducted, and the components are slightly adapted to restrict the noise growth. Additionally, valid zero-knowledge proofs are provided and a concrete instantiation achieving a security level of 128 bits is shown.

Nicolin Decker

No abstract is available for this record.

Carmen Wabartha

The end-to-end verifiable e-voting system Ordinos [26] is primarily characterized by its tally-hiding property, which ensures that only the actual election result, e. g., the winner of the election, is revealed while the full tally consisting of the aggregated votes stays hidden. Ordinos is an abstract model that guarantees tally-hiding, verifiability and vote privacy if the underlying cryptographic primitives satisfy certain requirements. It uses a multi-party-computation protocol over an additively homomorphic encryption scheme and guarantees active security with zero-knowledge proofs. Ordinos has already been instantiated for several election systems using the Paillier [35] encryption scheme, which can be broken by Shor’s algorithm [41]. The aim of this thesis is to instantiate Ordinos post-quantum secure using a variant of Regev’s LWE-based cryptosystem [39], which is adapted to realize an actively secure threshold encryption scheme over an arbitrary plaintext space. Then a noise analysis of the arithmetic and logical components used in the MPC-protocol of the Paillier instantiation is conducted, and the components are slightly adapted to restrict the noise growth. Additionally, valid zero-knowledge proofs are provided and a concrete instantiation achieving a security level of 128 bits is shown.

Ruiteng Zhang, Pingbin Luo, Qiong Huang

No abstract is available for this record.

Chen-Fan Chang, Ting‐Yu Chang, Chih-Chieh Chang, Te-Chuan Chiu · 6 authors

No abstract is available for this record.

Andrey Khalov, Olga Muratovna Ataeva

Background: Ontologies and knowledge graphs have become critical for structuring data into machine-interpretable knowledge, especially in dynamic domains like IT service management (ITSM). Traditional ontology engineering relies heavily on domain experts, making it costly and slow. This study investigates whether a domain-specific ontology can be extended from a top-level ontology without expert involvement, using the IT service management ontology (ITSMO) and the descriptive ontology for linguistic and cognitive engineering (DOLCE-lite) as a test case used in this study. Methodology: We propose an automated mapping approach integrating lexical approaches, embeddings, graph neural networks (GNN), and large language models (LLMs). Two primary mapping methods were developed: (1) embedding-based matching, computing cosine similarity between class embeddings from DOLCE and ITSMO; and (2) LLM-based matching, prompting a language model (GPT-4o) to evaluate class compatibility on a numeric scale. We also experiment with GraphSAGE GNN to enrich embeddings with ontology structure. Z-score clustering is applied to similarity scores to select top candidate mappings while filtering out outliers from the top cluster. The methodology operates with no annotated data and was validated using three-steps approach: GPT-4o as a surrogate expert for baseline class matching evaluation, expert spot-check, and OWL reasoner (Pellet and HermiT) to prove logical consistency (Glimm et al., 2014; Sirin et al., 2007). Results: The automated method successfully mapped ITSMO classes under DOLCE, yielding an integrated ontology (80 classes) that extends DOLCE into the ITIL domain with minimal expert intervention (expert consolidated suggestions into a result ontology). The LLM-based approach (GPT-4o) achieved the best performance with 73.5% accuracy for top-1 mappings and 82.4% for top-3 (cluster) inclusion. Transformer-based embeddings (e.g., DeBERTa) also performed well (up to 39.3% top-1, outperform random matching with 27.6% accuracy), but classical graph embeddings (RDF2Vec/Node2Vec) failed due to the small ontology size. Incorporating a GNN provided smoother embedding distributions and increased correct mappings within top-3 clusters, but it slightly reduced top-1 precision in this small-graph setting. These findings underscore the effectiveness of LLMs in zero-shot ontology alignment and the limitations of purely structural methods on limited data. Conclusions: This work demonstrates, as a proof-of-concept, that an upper-level ontology can be extended to a domain ontology automatically, with no or minimal expert involvement, by leveraging AI-based mapping techniques. The resulting new ontology integrates ITSMO into DOLCE, providing a consistent semantic foundation for IT domain knowledge graphs. The approach is immediately applicable to ITSM and suggests a generalizable framework for ontology expansion in other domains. Future work will focus on scaling the method to larger ontologies, automatically discovering new classes/relations from text, and evaluating the approach’s practical impact on IT service management processes.

Gabriel Silva Atencio

The growth of the Metaverse brings new security problems that traditional perimeter-based defenses can’t manage. This research proposes and tests an integrated Zero-Trust Architecture aimed to solve these weaknesses by merging artificial intelligence (AI)-driven behavioral threat detection, blockchain-based decentralized identification, and post-quantum cryptography. For anomaly detection, the architecture uses a federated ResNet-50 model; for data management that meets regulatory standards, it uses a Hyperledger Fabric-based identification system with Zero-Knowledge Succinct Non-Interactive Argument of Knowledge; and for key exchange that is immune to quantum attacks, it uses the CRYSTALS-Kyber algorithm. Penetration testing, a Delphi study with 20 experts, and user surveys all show that the architecture greatly improves security metrics. This system has a False Acceptance Rate (FAR) of 5.2%, which is 42.7% lower than the 9.1% FAR baseline of rule-based systems, 99.1% protection against Sybil attacks, and strong quantum resilience with a 1.2× latency penalty compared to AES-256. The approach also partially complies with the General Data Protection Regulation by using cryptographic erasure proofs. But these security improvements come at a cost: AI inference now uses 3.1 times more graphics processing unit resources. The results show that the suggested architecture creates a scalable, empirically validated basis for protecting decentralized virtual environments, striking a good balance between security, compliance, and performance trade-offs.

Rohan Sharma

No abstract is available for this record.

Jonas Ryan Nouri

No abstract is available for this record.

Chen Sun, Nurshazwani Muhamad Mahfuz, WANG YALI

No abstract is available for this record.

Özge Taş

Summary Zero-Knowledge Proof Machine Learning (ZKML) is a new approach that combines zero-knowledge proofs (ZKP) with machine learning (ML) to develop privacy-focused and secure artificial intelligence systems. ZKP are cryptographic techniques that enable one party to prove the validity of certain information without disclosing any additional data. This mechanism is particularly important in fields that require high levels of privacy, such as finance, healthcare, and identity verification. ZKML enables the cryptographic verification of the accuracy of model inferences or training processes without disclosing model parameters or user data. In the context of federated learning, the accuracy of each participant's contribution to the model training process can be verified using proof systems such as zk-SNARKs, thereby enabling a secure collaboration environment without the risk of data leakage. Similarly, during the inference phase, it can be verified whether the model produced a specific output, which builds trust in fields such as medicine and finance where sensitive decisions are made. Currently, the production of ZK proofs requires high computing power. However, thanks to advances in hardware, distributed systems, and cryptography, proof production is now more feasible even for larger and more complex models. Startups like Modulus Labs and tools like the ezkl library enable the production of ZK proofs on models in ONNX format, offering practical solutions to developers. Systems like Plonky2 have reduced proof production for models with millions of parameters to just minutes. ZKML has a bunch of use cases, including on-chain ML verification (e.g., in DeFi protocols), transparency of ML services (MLaaS), fraud detection, and private inference. For example, in decentralized Kaggle-like systems, the accuracy of a model can be proven without revealing its details. In healthcare, patients can access diagnostic results without disclosing their data. In conclusion, ZKML combines privacy protection with the security of verification processes, enabling the development of more ethical and reliable artificial intelligence systems. This approach, which lies at the intersection of cryptography and machine learning disciplines, has the potential to increase the transparency and security of AI systems at both technical and societal levels.

Fady R. Alkhateeb, Adib Habbal

The rapid growth of the metaverse has led to a scattered ecosystem in which digital assets are deployed on different blockchain platforms. This disintegration creates significant challenges for interoperability, as users need secure, decentralized, and privacy-preserving protocols to enable interoperability between chains. Existing solutions typically depend on centralized exchanges or third-party relays, introducing a single point of failure and potential privacy risks. We propose MAM (Metaverse Asset Management), a novel user-centric protocol utilizing zkSNARK technology (Zero-Knowledge Succinct Non-Interactive Argument of Knowledge) that enables seamless movement of metaverse assets across various blockchain platforms. MAM’s architecture ensures privacy by generating all zkSNARK proofs locally on the user’s machine, ensuring that sensitive data, including private keys and asset metadata, never leave the device. The protocol employs a secure one-time setup to distribute the global circuit-specific proving key, ensuring the permanent destruction of toxic-waste data. Experimental evaluation demonstrates that MAM achieves a constant and minimal proof size (192 bytes), low gas cost (281,107 Gas per verification), and an end-to-end asset transfer latency under 15 seconds, outperforming recent alternatives such as MetaOpera and MAP. Static security analysis confirms the robustness of MAM’s smart contracts against the most significant vulnerability types. This research enhances the state-of-the-art of privacy-preserving and scalable cross-metaverse interoperability, providing a practical approach for fully decentralized digital asset management and transfer across the Metaverse.

R. N. Karthika, C. Valliyammai, P. Sundaravadivel, Augustian Isaac R

No abstract is available for this record.

Sorger, Tom

The growing importance of software supply chain security has revealed the critical need for securely sharing Software Bills of Materials (SBOMs). SBOMs enhance transparency by providing a detailed inventory of software components, but can inadvertently expose sensitive proprietary information and vulnerabilities when shared publicly. Addressing this challenge, this thesis explores the use of cryptographic techniques to achieve privacy-preserving and verifiable SBOM sharing. This thesis addresses this challenge by proposing zkSBOM (Zero-Knowledge Software Bill of Materials), a proof-of-concept system for privacy-preserving and verifiable SBOM sharing. It explores the system requirements and design for achieving secure yet transparent SBOM sharing, the effectiveness of various cryptographic techniques in safeguarding sensitive SBOM information, and the integration with real-world SBOMs. Through system design analysis and an experimental approach, this work provides solid insights into privacy-enhanced SBOM-sharing. The results demonstrate that the use of established cryptographic techniques is suitable to securely share SBOMs in real-world scenarios. We propose a centralised system enabling software vendors to upload their SBOMs and allowing verifiers to query for vulnerabilities. Additionally, we offer a local verifier system that allows verifiers to independently validate the proofs generated by the centralised system. The system leverages cryptographic techniques such as Merkle Trees, Sparse Merkle Trees, Merkle Patricia Tries, and Zero-Knowledge Sets. Using them, zkSBOM enables selective disclosure of SBOM information efficiently. The system ensures transparency through verifiable inclusion and non-inclusion proofs while safeguarding critical information. In a case study, we successfully ingest 16 out of 18 SBOMs and generate inclusion proofs for dependencies affected by a given vulnerability. This research contributes to advancing privacy-preserving SBOM sharing, paving the way for broader adoption in the software industry while strengthening the security of software supply chains.

Junkai Yi, Xuefeng Gao, Xin Wang, Lingling Tan

No abstract is available for this record.

Yurii Paslavskyi, Ihor Kroshnyi

An important cryptographic mechanism that guarantees confidentiality (the zero-disclosure property) and ensures that it is impossible to prove a false statement to the verifier is zero-disclosure proofs. A popular implementation of zero-disclosure proofs is short, noninteractive proofs that can be quickly verified and that do not require interaction between the parties after the initial setup. The main direction in the development of modern proof systems is interactive proof, which is built in two steps. The first is sending a confirmation of the polynomial of an interactive oracle proof and the second is creating correct oracles of the polynomial commitment scheme using well-defined cryptographic methods for evaluating polynomials. Verifying the use of the same coefficients in each linear combination requires checking both polynomial consistency and variable consistency. To construct general schemes of concise non-interactive zerodisclosure knowledge argument, an interactive oracle proof polynomial was proposed that models messages as polynomial oracles. All tests are proved using polynomial commitment schemes and then evaluated with zero knowledge at a point specified by the person verifying the information. The reliability and confidentiality of all tests are based on three main categories of interactive oracle proof polynomials, namely polynomial commitment schemes with conjunction, with inner product argument and with code theory. The protocols of concise noninteractive zero-disclosure knowledge arguments are implemented through high-level programs (compilers), which are converted into an intermediate representation, i.e. a scheme defined by a system of constraints. The compilers used are divided into domain-oriented languages, embedded domain-oriented languages, and zero-knowledge virtual machines. Specialized domain-oriented hardware description languages or programming languages offer an adapted syntax for efficiently expressing constraints in arithmetic schemes. Embedded domain-oriented languages are implemented as functions in general-purpose programming languages and are oriented to the overhead schemes inherited from the embedded language. Zero-knowledge virtual machines process the opcode of the fetch-decodeexecute cycle, replicating the computation trace for general programs and generating corresponding zeroknowledge proofs. They are compatible with existing high-level programming languages and can use the features of existing compilers. Compilers are evaluated for cross- or syntactic compatibility. In general, the biggest obstacle to using non-interactive proof libraries is the lack of documentation. Standardization can help developers compare important features across libraries and establish a more consistent performance baseline. Library documentation for these core features is implicit, and developers need to understand the underlying cryptographic techniques to choose an appropriate scheme. Standardization of compiler options is important, making it difficult to reuse existing tools.

Ramesh Krishna Mahimalur

This paper introduces a novel framework for Zero-Knowledge Infrastructure Verification (ZKIV) that combines chaos engineering principles with security operations and zero-knowledge proofs to create a robust infrastructure verification system. By leveraging these technologies within a DevOps context, organizations can validate the integrity and security posture of their infrastructure without revealing sensitive configuration details or credentials. This approach, which we term ChaosSecOps, represents a significant advancement in infrastructure security verification, enabling teams to verify compliance, detect misconfigurations, and identify vulnerabilities without exposing sensitive information. Through a detailed AWS implementation case study, this paper demonstrates how ZKIV can be applied to modern cloud environments to enhance security, streamline compliance verification, and build resilient systems.Executive SummaryThis paper introduces Zero-Knowledge Infrastructure Verification (ZKIV), a novel framework for validating the security and compliance of complex, modern infrastructure (particularly cloud environments like AWS) without exposing sensitive configuration details or credentials. ZKIV achieves this by combining principles from:• Zero-Knowledge Proofs (ZKPs): While full cryptographic ZKPs are discussed, the paper focuses on "functional zero-knowledge" approaches practical for infrastructure. This means proving that security controls are in place and functioning correctly without revealing the underlying configurations themselves. Examples include black-box testing, output-only verification, and attestation.• Chaos Engineering: The deliberate introduction of controlled failures (like misconfigurations or simulated attacks) to test system resilience and the effectiveness of security controls.• Security Operations (SecOps): Continuous monitoring, threat response, and security automation practices.• DevOps: Leveraging automation, continuous integration/continuous delivery (CI/CD), and Infrastructure as Code (IaC). The integration of these disciplines is termed ChaosSecOps. Key Benefits of ZKIV• Enhanced Security: Verification happens without needing to expose sensitive data, reducing the attack surface.• Improved Compliance: Continuous, automated verification ensures ongoing adherence to regulatory and internal security policies (e.g., PCI DSS, SOC 2). Evidence is collected in a zero-knowledge manner.• Reduced Operation Risk: Proactive identification of vulnerabilities and misconfigurations before they can be exploited.• Increased Confidence: Greater assurance in the security posture due to systematic and continuous testing.• Scalability: Verification is automated and can be used across many systems.• Efficiency: Verification can be done faster.ZKIV Framework ComponentsThe framework consists of several key components that work together:• Verification Orchestrator: The central control point for scheduling, executing, and managing verification tests.• Policy Engine: Defines and enforces security and compliance rules (using policy-as-code).• Test Agents: Ephemeral (short-lived) components deployed within the infrastructure to perform black-box testing.• Evidence Collection System: Gathers test results in a way that preserves zero-knowledge (no sensitive data revealed).• Remediation Framework: Automates the fixing of identified security issues.AWS Implementation Case StudyA detailed case study demonstrates ZKIV implementation within a financial services organization using AWS. Key AWS services used include AWS Organizations, Security Hub, Lambda, Step Functions, EventBridge, Systems Manager, S3, and Config. The case study shows practical application of zero-knowledge techniques like:• Least-Privilege IAM Roles: Verification agents have only the permissions needed to check configurations, not to access the data they protect.• Output-Only Verification: Validating database security settings without querying the database itself.• Black-Box Network Testing: Using isolated containers to test network segmentation without accessing internal network configurations.

Shai Barney Levin

Constructing efficient isogeny-based protocols is an active area of research in post-quantum cryptography. An important building block in constructing such protocols is non-interactive zero-knowledge proofs of knowledge, which convince a verifier that a prover possesses some secret information about an isogeny without revealing it. Prior proofs of knowledge of an isogeny based on Σ-protocols [JD11, DDGZ22,GPS17,BCC+23] suffer from various deficiencies. They require computing large degree coprime N′-isogenies, which means they must either work over larger field extensions or choose a prime large enough to have rational N′-torsion. Further, they suffer from poor performance due to their small challenge space, resulting in many parallel repetitions to achieve negligible soundness error. This thesis presents new techniques for constructing isogeny proofs of knowledge by constructing generic instances which encode isogeny relations. These instances can then be implemented with a generic proof system (i.e. a zk-SNARK) to produce non-interactive arguments for isogeny relations, such as proving knowledge of a cyclic (2^n)-isogeny. Compared to prior approaches, zk-SNARKs allow for several orders of magnitude improvement to prover and verification times, and proofs are additionally succinct, they scale sublinearly with the witness size. To motivate our approach with an application, we construct a variant of the CGL hash function [CLG09], requiring trusted setup, along with an associated proof of honest evaluation via generic techniques. Given the function satisfies a conjectured notion of unpredictability, we use it, along with its evaluation proof to construct a verifiable random function (VRF), in the random oracle model. As an independent contribution, we prove the security of the associated generic VRF transformation. As an orthogonal contribution, we explore the shortcomings of various works which construct proofs of knowledge in modern literature in a dedicated cryptanalysis section. In particular, we show that a peer-reviewed variant of SeaSign [Kim24] is not zero-knowledge, leading to a key recovery attack; that a proof of knowledge of a commitment to an elliptic curve discrete logarithm [FLM22] is not sound (and propose a fixed protocol), and that the CROSS identification protocol [BBB+24] does not satisfy their claimed level of zero-knowledge.

George Teşeleanu

Abstract We present two simple zero-knowledge interactive proofs that can be instantiated with many of the standard decisional or computational hardness assumptions. Compared with traditional zero-knowledge proofs, in our protocols, the verifier starts first, by emitting a challenge, and then, the prover answers the challenge.

Ravani, Leonardo, Kistler, Tobias

Imagine sharing that you know a secret without revealing the secret itself. This is what zero-knowledge proofs (ZKPs) aim to do. In ZKPs there is a prover who claims knowledge of something and a verifier who checks this claim. The goal of this project is to further explore current technologies revolving around ZKPs and understand possible adaptations to an everyday application beyond blockchain use cases. To explore the practical use of ZKPs, this project introduces a web puzzle application that keeps the solutions of individual users private using ZKPs. A user can solve a logic- based puzzle like Binairo or Sudoku and check the validity of their solution by sharing only a ZKP of the solution. That way, the solution never leaves the user’s device. To further strengthen the security, the following two checks are implemented: (1) making sure that the solution matches the original puzzle, and (2) integrating the user’s ID during the generation process. These checks prevent users from reusing a proof to “solve” other puzzles or for the proof to be stolen by another user. To implement this application, different ZKP frameworks are considered. Circom and snarkjs are selected because of their active development, clear documentation and good web development capabilities. The final result is a secure application that demonstrates how ZKPs can be applied in a realistic and practical way. This highlights their broader potential in digital security. In most applications, the impact of ZKPs is intentionally hidden, as good cybersecurity aims to operate in the background. The ZKP-Puzzles application puts the ZKPs in the spotlight and visualizes how ZKPs work.

Istiaque Ahmed, Kentaroh Toyoda, Tadashi Nakano, Thi Hong Tran

Traditional digital identity systems struggle with centralization, vulnerability to manipulation, and a lack of transparency. In distributed identity, different cryptographic methods are used for issuing credentials, that create challenges during presentation. It suffer from a fundamental interoperability barrier with heterogeneous digital-signature schemes, forcing each verifier either to implement every scheme or to trust a central translation gateway. We propose a signature-agnostic verification framework that eliminates this barrier. The core idea is to commit a salted root hash of credential claims to a distributed ledger and ensure the authenticity using a smart contract. A zero-knowledge proof (zk-SNARK) is used to prove a selected claim set without revealing actual information. The verification reduces to a single hash-consistency check, and the verifier never touches issuer-specific signatures. A pleasant side effect is that the same verifiable presentation (VP) can be reused across verifiers and sessions, since trust derives from the on-chain anchor rather than transient signatures. This research will advance the identification ecosystem, enabling applications such as eKYC across finance, healthcare, and other sectors. We implement our method on Ethereum Virtual Machine (EVM) using Groth16, benchmark gas cost, proof size, and latency, and show its feasibility and computational efficiency. The privacy and security analysis confirms that the proposed solution is resistant to various attacks.

Adam Mazzocchetti

No abstract is available for this record.